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JENNER&BLOCK 


BY EMAIL TO IDTHEFT@OAG.STATE.MD.US 

June 30, 2017 

Attorney General Brian E. Frosh 
Office of the Attorney General 
Attn: Security Breach Notification 
200 St. Paul Place 
Baltimore, MD 21202 
ldtheft@oag.state.md.us 

Dear Attorney General Frosh: 


Nancy Libin 

Tel +1 202 639 6086 

NLibin@jenner.com 


Pursuant to Md. Code Com. Law § 14-3501,1 am writing on behalf of Jenner & Block LLP, to notify you 
that the firm has been made aware by its travel agency of unauthorized access to personal information 
involving one Maryland resident. 

Specifically, Jenner & Block has learned that there was unauthorized access to the Sabre Hospitality 
Solutions SynXis Central Reservations system (Hospitality CRS), which facilitates the booking of hotel 
reservations, including those made by Jenner & Block’s travel agency, Ultramar Travel (Ultramar). Sabre 
notified Ultramar on or about June 6, 2017 (and Ultramar in turn notified Jenner & Block on June 22) that 
based on a forensic examination, it had determined that an unauthorized party gained access to account 
credentials that permitted unauthorized access to unencrypted payment card information, as well as 
certain reservation information, for a subset of hotel reservations processed through the Hospitality CRS. 
The Sabre investigation determined that the unauthorized party first obtained access to payment card and 
other reservation information on August 10, 2016, and the last access to payment card information was on 
March 9, 2017. 


According to Sabre, the unauthorized party was able to access payment card information for hotel 
reservations, including cardholder name; card number; card expiration date; and, potentially, card security 
code. The unauthorized party was also able, in some cases, to access certain information such as guest 
name, email, phone number, address, and other information. Information such as Social Security, 
passport, or driver’s license number was not accessed. 

Please be assured that Jenner & Block has taken every step necessary to address this incident. Sabre 
engaged a leading cybersecurity firm to support its investigation. Sabre also notified law enforcement and 
the payment card brands about this incident. We have no reason to believe there is a vulnerability in the 
Ultramar system related to this incident. 

Jenner & Block notified its current employees on June 30, 2017 and recommended that they contact their 
bank, inform it of the incident, and request a new credit card. Jenner & Block is offering one year of free 
credit monitoring through Experian IdentityWorks SM . 
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Attached please find a copy of the formal notice that is being mailed today. If you have any questions 
about this incident or require additional information, please contact me at NLibin@ienner.com , (202)- 
639-6086. 

Sincerely, 

Nancy Libin 




